We have aroud 3k Forticlients used to establish a SSL/IPSec VPN with a fortigate.They are managed by a FortiEMS
On FortiEMS, we configured "on-fabric detection rules" with a LocalIP/subnet rule type so that the forticlient detects when the user is off fabric (when his IP changes) and shows him a list of VPN that he can connect to.
The problem (i think) is when the user is at home, the FC doens't detect the change in the IP adress and consider him still "on fabric" so he doesn't show him the VPN list.
We tried ipconfig/release and renew and reload the computer but the problem persist.
Versions : FC : 184.108.40.2065 and FEMS 6.4.4 build 1658
that's exactly right.... If you are "off-net" but cannot reach EMS, you'll not be able to talk to the server and get the other policy for "off-net". We setup split DNS so that our EMS server is accessible from the inside or outside. (ie: ems.yourdomain.com = 220.127.116.11 or your WAN IP block and ems.yourdomain.com on the inside = 10.11.12.13) All you need is a VIP on your gate to allow TCP.8013 into the EMS from the WAN
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.